CWE-502 · Deserialization of Untrusted Data

3073 CVEs classified under CWE-502 (Deserialization of Untrusted Data). Browse by severity and year.

Top CVEs for CWE-502
CVESeverityScorePublishedSummary
CVE-2026-17061Critical10.02026-08-11A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated re…
CVE-2026-11756Critical10.02026-07-28A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEX…
CVE-2026-60366Critical10.02026-07-22Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a…
CVE-2026-41104Critical10.02026-05-22Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network.
CVE-2026-43633Critical10.02026-05-19HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and…
CVE-2026-45829Critical10.02026-05-18A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary…
CVE-2026-33819Critical10.02026-04-23Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.
CVE-2026-20131Critical10.02026-03-04A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker…
CVE-2026-25632Critical10.02026-02-06EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EP…
CVE-2025-14931Critical10.02025-12-23Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attacker…
CVE-2025-55182Critical10.02025-12-03A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following…
CVE-2025-58384Critical10.02025-09-26In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc ad…
CVE-2025-10035Critical10.02025-09-18A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deseriali…
CVE-2025-42944Critical10.02025-09-09Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious…
CVE-2025-48200Critical10.02025-05-21The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.
CVE-2025-30012Critical10.02025-05-13The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to sen…
CVE-2025-32444Critical10.02025-04-30vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration…
CVE-2024-44102Critical10.02024-11-12A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with redundancy configured)…
CVE-2024-5932Critical10.02024-08-20The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 v…
CVE-2024-37099Critical10.02024-08-19Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.
All CVEs classified under CWE-502 — newest first (page 1 of 31)
CVESeverityScorePublishedSummary
CVE-2026-73389Critical9.82026-08-19Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
CVE-2026-73364Critical9.82026-08-19Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.
CVE-2026-75987High7.32026-08-19A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/para…
CVE-2026-74012High8.82026-08-18Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.
CVE-2026-73397Critical9.82026-08-18Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
CVE-2026-73380Critical9.82026-08-18Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
CVE-2026-73376Critical9.82026-08-18Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73366Critical9.82026-08-18Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
CVE-2026-73341Critical9.82026-08-18Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
CVE-2026-66620High7.22026-08-18Editor PHP Object Injection in OptionTree <= 2.7.3 versions.
CVE-2026-59940Critical9.82026-08-18Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attack…
CVE-2026-32470Critical9.82026-08-18Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
CVE-2026-32465High8.82026-08-18Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
CVE-2026-16138High8.02026-08-17In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access…
CVE-2024-13784Critical9.82026-08-16The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including…
CVE-2026-10035Medium6.62026-08-16The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization o…
CVE-2026-16099High8.82026-08-16The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item fu…
CVE-2025-7639High7.12026-08-14The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially…
CVE-2026-19826High7.32026-08-14A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerial…
CVE-2026-10571Medium5.72026-08-13IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, a…
CVE-2026-66256High7.22026-08-13** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users wit…
CVE-2026-28176High8.82026-08-13Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
CVE-2026-28149Critical9.82026-08-13Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
CVE-2026-27380High7.22026-08-13Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.
CVE-2026-67579High7.42026-08-12Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pag…
CVE-2026-73325High7.82026-08-12Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a…
CVE-2026-67587High8.82026-08-12Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback…
CVE-2026-67260High7.32026-08-12Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the…
CVE-2026-59242Medium5.42026-08-12Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` with…
CVE-2026-58076High8.82026-08-12Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiatin…
CVE-2026-68756Medium6.62026-08-12A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
CVE-2026-18634High8.42026-08-11An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A…
CVE-2026-48397High8.62026-08-11Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current…
CVE-2026-70321High8.82026-08-11Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-66808High8.82026-08-11Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-66805High8.82026-08-11Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-65815High8.82026-08-11Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVE-2026-65665High8.82026-08-11Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-65663High8.82026-08-11Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-65658High8.82026-08-11Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-64901High8.82026-08-11Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-63516Medium6.52026-08-11Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-63514High8.82026-08-11Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-62912Medium6.52026-08-11Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
CVE-2026-59124Critical9.82026-08-11Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.
CVE-2026-355022026-08-11Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of priv…
CVE-2026-17061Critical10.02026-08-11A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated re…
CVE-2026-15555High8.82026-08-11A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshalle…
CVE-2026-18948Critical9.92026-08-10A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' libra…
CVE-2026-69659Medium5.52026-08-09Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor…
CVE-2026-16267High8.12026-08-08The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing una…
CVE-2026-68772High8.02026-08-07ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifa…
CVE-2026-71560Critical9.12026-08-07Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing s…
CVE-2026-71559High7.52026-08-07Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted da…
CVE-2026-71558Critical9.82026-08-07Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input pa…
CVE-2026-16258Critical9.82026-08-07The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP…
CVE-2026-50515Critical9.92026-08-07Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
CVE-2026-65581Critical9.82026-08-06Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.
CVE-2026-65579Critical9.82026-08-06Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.
CVE-2026-65578Critical9.82026-08-06Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
CVE-2026-65577Critical9.82026-08-06Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.
CVE-2026-65576Critical9.82026-08-06Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.
CVE-2026-65575Critical9.82026-08-06Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.
CVE-2026-65574Critical9.82026-08-06Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
CVE-2026-65573Critical9.82026-08-06Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
CVE-2026-65572Critical9.82026-08-06Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
CVE-2026-65571Critical9.82026-08-06Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
CVE-2026-65556Critical9.82026-08-06Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
CVE-2026-65552Critical9.82026-08-06Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
CVE-2026-65549High7.22026-08-06Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.
CVE-2026-28139Critical9.82026-08-06Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
CVE-2026-66909Critical9.82026-08-06Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any at…
CVE-2026-70426Critical9.02026-08-05In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class f…
CVE-2026-71294High7.62026-08-05Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions…
CVE-2026-71281High8.82026-08-05Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101)…
CVE-2026-61484Critical9.82026-08-05** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project…
CVE-2026-70554Critical9.82026-08-04MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serial…
CVE-2026-47623High8.22026-08-04NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability mi…
CVE-2026-69098Critical9.82026-08-04kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiat…
CVE-2026-18642High7.82026-08-03Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue af…
CVE-2026-16297Medium4.12026-08-03The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrat…
CVE-2025-15672High8.12026-08-03The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated…
CVE-2026-3245High7.52026-08-03A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.
CVE-2026-16062Medium6.62026-08-02The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event con…
CVE-2026-68771Critical9.82026-07-31ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitr…
CVE-2026-12720High7.52026-07-31The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, l…
CVE-2026-11536High8.52026-07-30IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.
CVE-2026-15976Critical9.82026-07-30SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, whe…
CVE-2026-15969Critical9.82026-07-30SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command executi…
CVE-2026-12118Critical9.82026-07-30IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserializa…
CVE-2026-57859High7.52026-07-30e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database wr…
CVE-2026-1360High7.52026-07-30The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unse…
CVE-2026-65883Critical9.82026-07-29Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection i…
CVE-2026-58163High7.52026-07-29Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-14974High8.12026-07-28IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted…
CVE-2026-14512Critical9.82026-07-28IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to byp…
CVE-2026-66713Critical9.82026-07-28Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache…
CVE-2026-11756Critical10.02026-07-28A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEX…
CVE-2026-65617High8.82026-07-27A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under…
CVE-2026-63077Critical9.82026-07-27In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol